NPM 组件包 epic-geo-ip 等恶意获取主机敏感信息（MPS-2023-8302）
漏洞描述
当用户安装 1.0.1 版本的 epic-geo-ip、epic-dashboard-widgets、epic-community-api 等npm组件包时会向 lupin.monster 域名发送 get 请求，从而泄漏用户主机的 IP 地址。
| 漏洞名称 | GeoServer 存在 sql 注入漏洞 |
|---|---|
| 漏洞类型 | 内嵌恶意代码 |
| 发现时间 | 2023/3/17 |
| 漏洞影响广度 | 极小 |
| MPS编号 | MPS-2023-8302 |
| CVE编号 | - |
| CNVD编号 | - |
影响范围
epic-geo-ip@[1.0.1, 1.0.1]
epic-dashboard-widgets@[1.0.1, 1.0.1]
epic-community-api@[1.0.1, 1.0.1]
epic-deployment-tools@[1.0.1, 1.0.1]
epic-feature-flag@[1.0.1, 1.0.1]
epic-forum-api@[1.0.1, 1.0.1]
epic-social-integration@[1.0.1, 1.0.1]
epic-voice-chat-service@[1.0.1, 1.0.1]
epic-game-server-tools@[1.0.1, 1.0.1]
epic-streaming-api@[1.0.1, 1.0.1]
epic-http-client@[1.0.1, 1.0.1]
epic-feedback-api@[1.0.1, 1.0.1]
epic-payment-gateway@[1.0.1, 1.0.1]
epic-notification-service@[1.0.1, 1.0.1]
epic-dev-portal-backend@[1.0.1, 1.0.1]
epic-user-management@[1.0.1, 1.0.1]
epic-license-validator@[1.0.1, 1.0.1]
epic-crypto-utils@[1.0.1, 1.0.1]
epic-security-utils@[1.0.1, 1.0.1]
epic-telemetry@[1.0.1, 1.0.1]
epic-dev-portal-frontend@[1.0.1, 1.0.1]
epic-reporting-tools@[1.0.1, 1.0.1]
epic-rate-limiting@[1.0.1, 1.0.1]
epic-gdpr-compliance@[1.0.1, 1.0.1]
epic-game-sdk@[1.0.1, 1.0.1]
epic-push-notification@[1.0.1, 1.0.1]
epic-game-metrics@[1.0.1, 1.0.1]
epic-game-launcher-api@[1.0.1, 1.0.1]
epic-profanity-filter@[1.0.1, 1.0.1]
epic-graphql-resolvers@[1.0.1, 1.0.1]
epic-platform-frontend@[1.0.1, 1.0.1]
epic-platform-api@[1.0.1, 1.0.1]
epic-image-processing@[1.0.1, 1.0.1]
epic-chat-service@[1.0.1, 1.0.1]
epic-billing-api@[1.0.1, 1.0.1]
epic-build-tools@[1.0.1, 1.0.1]
epic-cloud-save@[1.0.1, 1.0.1]
epic-component-library@[1.0.1, 1.0.1]
epic-leaderboard-service@[1.0.1, 1.0.1]
epic-database-utils@[1.0.1, 1.0.1]
epic-event-logging@[1.0.1, 1.0.1]
epic-firebase-integration@[1.0.1, 1.0.1]
epic-game-analytics@[1.0.1, 1.0.1]
epic-game-stats@[1.0.1, 1.0.1]
epic-moderation-tools@[1.0.1, 1.0.1]
修复方案
避免使用受影响的组件包
参考链接
https://www.oscs1024.com/hd/MPS-2023-8302
关于墨菲安全
墨菲安全是一家为您提供专业的软件供应链安全管理的科技公司，核心团队来自百度、华为、乌云等企业，公司为客户提供完整的软件供应链安全管理平台，围绕SBOM提供软件全生命周期的安全管理，平台能力包括软件成分分析、源安全管理、容器镜像检测、漏洞情报预警及商业软件供应链准入评估等多个产品。为客户提供从供应链资产识别管理、风险检测、安全控制、一键修复的完整控制能力。
开源项目：https://github.com/murphysecurity/murphysec/?sf=qbyj
产品可以极低成本的和现有开发流程中的各种工具一键打通，包括 IDE、Gitlab、Bitbucket、Jenkins、Harbor、Nexus 等数十种工具无缝集成。
免费代码安全检测工具： https://www.murphysec.com/?sf=qbyj
免费情报订阅： https://www.oscs1024.com/cm/?sf=qbyj
